Privacy Policy

1. Who we are

MCPForm.io is a software product built and run by Talitu Ltd (“we”, “us”, “our”). Talitu Ltd is a company registered in England and Wales (company number 10295016). Our registered office is 483 Green Lanes, London N13 4BS.

With MCPForm.io, our customers make lead magnet forms (such as calculators, quizzes, assessments, enquiry forms and onboarding forms) from inside their AI tool, through our MCP server at mcp.mcpform.io, our API at api.mcpform.io or our command-line tool. They see their leads and responses in a dashboard at app.mcpform.io. Their public forms are served at addresses on mcpforms.io (with an “s”), for example https://<workspace>.mcpforms.io/<form>, and at short links on mcpforms.io.

We play one of two roles, depending on whose data it is:

• We are the controller for data about visitors to www.mcpform.io and about our customers and their team members. We decide how that data is used.
• We are a processor for data about people who fill in a customer’s form. The customer who made the form is the controller. We handle that data only on the customer’s instructions.

Privacy contact: [email protected].

2. Who this policy covers

This policy speaks to three groups of people. Find the one that fits you.

This policy applies to people in the United Kingdom, the European Economic Area, the United States and other places where MCPForm.io is used.

3. Data we collect

4. How we use your data

Visitors to www.mcpform.io

• To show you the site, answer your messages and send what you asked for.
• To see how the site is used and improve it, where you have agreed to analytics.
• To send you news about MCPForm.io where you have asked for it. You can stop at any time.

Customers and team members

• To create and run your organisation, workspaces and team, and to let you sign in.
• To run the service you use, including the MCP server, API, command-line tool and dashboard.
• To take payment, when paid plans are live, and to keep billing records.
• To send service emails, such as invitations, security notices and changes to our terms.
• To give support, keep the service secure and stop fraud and misuse.
• To understand how the product is used so we can fix and improve it.
• To meet our legal, tax and accounting duties.

People who fill in a customer’s form

We use this data only to run the service for the customer and on their instructions: to show the form and its result, store the answers, add lead details and fit scores where the customer turns them on, send the lead to the customer’s tools, send follow-up emails to people who opted in, keep the service secure and stop abuse. We do not use it for our own marketing and we do not sell it.

5. Lead details, fit scores and automated decisions

Added lead details. If a customer turns this on, MCPForm.io looks up a lead’s company, job title, company website and LinkedIn profile from third-party data providers, using the email address or name the person gave on the form. We do this only on the customer’s instruction and as their processor. The provider receives the details needed for the look-up and returns what it holds.

Fit scores. A customer can score each lead against rules the customer writes, such as company size or role. The score always shows the reasons behind it. The customer sets the rules and decides what to do with the score.

No automated decisions with legal effect. A fit score helps a business choose which leads to follow up first. It is not a decision that has a legal or similarly significant effect on the person, such as a decision about credit, a job or access to a service, and MCPForm.io is not built for that. Customers must not use it for decisions of that kind. As controller for customer data, we do not make decisions about you based only on automated processing that have legal or similarly significant effects.

Your AI tool. Customers work with MCPForm.io through AI tools of their own choosing, such as Claude, ChatGPT, Claude Code, Codex or n8n. When a customer asks their AI tool to read or change forms or leads, that data passes to the AI tool’s provider under the customer’s own agreement with that provider. That provider is the customer’s choice and is not our sub-processor.

6. Emails to leads

A customer can send follow-up emails to the people who fill in their forms. MCPForm.io sends these only to people who opted in on the form. Every one of these emails has a one-click unsubscribe. A stop always wins: once someone unsubscribes or asks to stop, we send them no more follow-up emails for that customer, whatever the customer’s settings say. We keep a record of the stop so it holds.

These emails are sent for the customer, as their processor, through a transactional email provider. The customer is responsible for what the emails say and for having a lawful reason to send them.

Service emails to customers and team members (such as invitations, sign-in and security notices) go through the same kind of provider, with Talitu Ltd as controller.

7. If you filled in a form made with MCPForm.io

Forms on mcpforms.io addresses are made and owned by our customers, not by us. When you fill in one of these forms, the business that made it is the controller of your data. Talitu Ltd is its processor. We handle your data only on that business’s documented instructions and under our agreement with it.

Contact the business first. To see, correct or delete your answers, to stop emails or to ask how your data is used, please contact the business that made the form. Its name should be on the form or in the emails it sends you, and its own privacy notice applies to you.

If you cannot reach them. Write to [email protected] with the form’s web address and the email you used. We will pass your request to the business that made the form and help it respond. We do not decide such requests ourselves, because the data is the business’s. Any follow-up email from a form also has a one-click unsubscribe that works straight away.

Where it goes. On the business’s instruction, your answers and lead details may be sent to its own tools, such as HubSpot, Slack, Google Sheets, email, signed webhooks, Zapier and others it connects. Once there, the data is held under that business’s own arrangements with those tools.

Abuse. If you think a form is misleading, unlawful or collecting data it should not, tell us at [email protected].

8. Legal bases for processing

Where we are the controller, we rely on these legal bases under UK GDPR and EU GDPR:

• Contract: to provide MCPForm.io to customers and their teams under our terms.
• Legitimate interests: to run, secure and improve MCPForm.io, stop misuse and grow the business, where your rights and interests do not override these.
• Consent: for analytics and marketing cookies on www.mcpform.io and for marketing emails where the law needs consent. You can withdraw consent at any time.
• Legal obligation: to meet our legal, tax and accounting duties.

Where we are a processor (section 7), the customer who made the form sets the legal basis and is responsible for it.

9. Who we share data with

We share personal data with:

• Service providers and sub-processors who help us run MCPForm.io. These include Google Cloud for hosting, databases, file storage and secrets (in the United States, region us-east1), Cloudflare for DNS, content delivery, security, our static apps and bot checks on public forms, WorkOS for sign-in, invitations and the sign-in step when you connect an AI tool, Stripe for payments (when paid plans are live), a transactional email provider, data enrichment providers (only when a customer turns lead details on) and Google Tag Manager and Google Analytics on www.mcpform.io (after consent). Each acts on our instructions under a written data processing agreement or its equivalent. The current list is on our Sub-processors page.
• The customer who made a form, for data given on that form, and the tools that customer tells us to send leads to.
• Professional advisers, such as legal and accounting advisers.
• Authorities, where the law requires it or to protect our rights.
• A buyer or successor, if the business or MCPForm.io is sold or reorganised.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising in a way that counts as a “sale” or “share” under US state privacy laws (see section 15).

10. Google API limited use

A customer can connect a Google account so MCPForm.io can send leads to Google Sheets. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

In particular: we use Google user data only to provide the features you connected. We do not use it to train general AI or machine-learning models. We do not sell it. We do not pass it to others except to provide the service, meet the law or keep it secure, and then only under confidentiality terms. No person reads it unless you agree to it for specific items, it is needed for security or abuse checks, the law requires it or it has been aggregated and made anonymous.

11. Cookies and tracking

On www.mcpform.io. In the UK and EEA, Google Tag Manager and Google Analytics load only after you agree through our cookie notice. Your choice is stored in your browser (as cookieConsent and cookieConsentDate) so we do not ask again each visit. If you send a form on our site, we set a first-party cookie, aw_id, which holds a scrambled (hashed) form of your email address and lasts 365 days. We may later add LinkedIn Insight or the Meta Pixel through Google Tag Manager. If we do, they will also load only after consent. You can change your choice at any time with the “Cookie settings” link in the footer.

On forms at mcpforms.io. A public form sets a session cookie only as needed to run the form, such as to keep your progress and pass the bot check. Our hosted form pages do not load marketing trackers unless the customer who made the form adds them. If they do, the customer is responsible for them and for asking for any consent needed. Forms on free plans show a “Built with MCPForm.io” line that links to www.mcpform.io.

Full detail is in our Cookie Policy.

Browser signals. Some browsers send a “Do Not Track” (DNT) or Global Privacy Control (GPC) signal. There is no common standard for DNT, so our site does not respond to it. Where US state law treats GPC as a valid opt-out request, we treat a GPC signal as a request to opt out of any “sale” or “sharing” of personal information and of targeted advertising for that browser or device.

12. Sensitive information

MCPForm.io does not ask for sensitive information on www.mcpform.io.

What forms should not collect. Unless we have agreed otherwise in writing, our Terms of Service and Acceptable Use Policy do not allow customers to use forms to collect payment card numbers, bank details, passwords, government identifiers (such as passport, National Insurance or social security numbers), health or medical records, biometric data or data about children.

If such data reaches us anyway, we handle it only as far as needed to deal with it safely and delete it, or ask the customer to, as soon as we can. Customers are responsible for having the rights, notices and consents needed for the data their forms collect.

13. How long we keep data

We keep personal data only as long as we need it for the reasons in this policy, including legal, tax and accounting duties.

When we no longer need data, we delete it or make it anonymous.

14. International transfers

Talitu Ltd is based in the United Kingdom. MCPForm.io is hosted on Google Cloud in the United States (region us-east1). At launch, every workspace’s data is held in the United States. Customers in the UK and EU can sign up, and we tell them at sign-up that their data, including the answers given on their forms, is held in the US. Some of our providers, such as Cloudflare, also process data in many countries to deliver and protect the service.

When personal data moves from the UK or EEA to the US or another country without an adequacy decision, we use approved safeguards. These include the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses for UK data, the EU Standard Contractual Clauses (SCCs) for EEA data and, where a US provider is certified, the EU-US Data Privacy Framework and its UK Extension. You can ask us for a copy of the safeguards at [email protected].

15. US privacy rights

This section applies if you live in a US state with a broad privacy law, such as California (CCPA and CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with similar laws. If you filled in a customer’s form, the business that made it handles these requests (see section 7).

Subject to your state’s law, you may have the right to:

• Know what personal information we collect, use, share and keep about you.
• Access a copy of your personal information.
• Correct wrong personal information.
• Delete personal information we hold about you, with the exceptions the law allows.
• Opt out of the sale or sharing of your personal information, targeted advertising and profiling for decisions with legal or similarly significant effects.
• Limit our use of sensitive personal information, where this applies.
• Equal treatment: we will not refuse service, charge more or give a lower level of service because you used your privacy rights.
• Appeal a refused request, where your state law gives that right.

To use these rights, email [email protected]. You can use an authorised agent to make a request for you, subject to checks.

We do not sell personal information for money. We do not knowingly sell or share the personal information of anyone under 16.

California residents can ask what personal information we have shared with third parties for those third parties’ own direct marketing (a “Shine the Light” request). We do not share personal information with third parties for their own direct marketing.

Categories of personal information (California). As controller, we collect the categories below, as the CCPA defines them, from you directly and from your use of our site and service. We share them with the types of recipient in section 9 for the purposes in this policy. We do not sell them.

We keep each category for the periods in section 13 and use it only for the purposes in this policy.

16. Special-category data

MCPForm.io is not designed for special-category data under UK and EU law (such as health, religion or ethnic origin). As section 12 explains, our terms limit what forms may collect. Where we have agreed in writing that a customer’s forms may collect data of this kind, we handle it only as their processor, on their documented instructions.

Customers are responsible for spotting any special-category or other sensitive data their forms collect, for having a lawful basis and any extra condition needed and for giving people the notices and asking for the consents the law requires.

17. Your rights

Under UK GDPR (and EU GDPR where it applies), you have the right to: access your personal data; correct it; have it deleted; restrict or object to its use; receive it in a portable form; and withdraw consent where we rely on consent. US state rights are in section 15.

Visitors, customers and team members: email [email protected]. We do not usually charge, and we reply within one month, as UK GDPR requires (longer for complex requests, and we will tell you if so). We may need to check who you are before we act.

People who filled in a customer’s form: please contact the business that made the form first, since it is the controller. If you cannot reach it, email [email protected] and we will pass your request on and help that business respond (see section 7).

18. Security

We use sensible technical and organisational measures to protect personal data. These include access controls, encryption in transit, keeping each workspace’s data apart at the database level, storing secrets in a dedicated secrets manager, bot checks on public forms, checks on our providers and a plan for handling incidents. Webhooks we send to customers’ tools are signed so the receiver can check they came from us. No way of sending or storing data is fully secure, but we work to protect your data and to respond properly to any incident.

19. Children

MCPForm.io is for businesses and for people aged 18 and over. We do not knowingly collect personal data from children, and customers must not aim their forms at children. If you think a child has given us data, contact [email protected] so we can remove it, or tell the business that made the form.

20. Additional notices

Some parts of MCPForm.io may have their own privacy notice or data processing terms (for example, the data processing terms in our agreement with a customer). Where one of those applies and conflicts with this policy, the specific notice or agreement applies for that part. Otherwise this policy and our Cookie Policy set out how we handle personal data.

21. Changes to this policy

We may update this policy from time to time. The “last updated” date shows when changes took effect. We will tell customers about important changes by email or in the dashboard where we reasonably can.

22. Contact and complaints

For privacy questions or to use your rights, email [email protected]. For general questions, email [email protected]. To report a form that is being misused, email [email protected].

If you are in the United Kingdom and are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. If you are in the European Economic Area, you can complain to your local data protection authority. If you are a US resident and your state law gives a right of appeal or a way to complain (for example, the California Privacy Protection Agency or your state attorney general), you can contact that body. We would like the chance to put things right first.

Supervisory authority and EU representative. Talitu Ltd is established in the United Kingdom, and the ICO is our supervisory authority. If you are in the EEA and have a concern we cannot resolve, you can also contact your local data protection authority.